Skip to content
FixSecurityHeadersScan a site

How to add Permissions-Policy on IIS

Last updated · Reviewed by a CISSP-certified security practitioner

To add Permissions-Policy on IIS, set the header in web.config with the value camera=(), microphone=(), geolocation=(), payment=(), usb…. Turns off browser features (camera, mic, geolocation) you don't use. Save web.config; IIS applies it on the next request. Recycle the app pool if needed. Then confirm it with curl -I or a free FixSecurityHeaders scan.

What does Permissions-Policy do?

Permissions-Policy disables powerful browser APIs for your page and any embedded iframes unless you explicitly allow them.

Risk if missing: Injected or third‑party scripts could request camera, microphone, geolocation or payment APIs.

What is the IIS configuration?

Add this to web.config:

web.config
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <add name="Permissions-Policy" value="camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()" />
      </customHeaders>
    </httpProtocol>
  </system.webServer>
</configuration>

How do I add it step by step?

  1. Open web.config.
  2. Paste the Permissions-Policy configuration shown below.
  3. Save web.config; IIS applies it on the next request. Recycle the app pool if needed.
  4. Run curl -I https://yourdomain.com and look for the permissions-policy line.
  5. Scan your site on FixSecurityHeaders to confirm the grade improved.

How do I verify it worked?

terminal
curl -sI https://yourdomain.com | grep -i "permissions-policy"
# expected:
# permissions-policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()

Check your site now

Free scan, instant grade, exact fixes for your stack.

What are the common mistakes?

  • Allow features you actually use, e.g. payment=(self) for Payment Request checkouts.
  • Headers in web.config apply to every response from that site.
  • Removing the Server header requires removeServerHeader (IIS 10+) or URL Rewrite.

Quick reference

HeaderPermissions-Policy
Recommended valuecamera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=()
StackIIS
Whereweb.config
ComplianceOWASP ASVS V14.4, SOC 2 CC6.8

FAQ

What value should I use for Permissions-Policy?

A safe default is camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=(). Allow features you actually use, e.g. payment=(self) for Payment Request checkouts.

Why isn't Permissions-Policy showing up on IIS?

Headers in web.config apply to every response from that site. Also clear any CDN or page cache, and check you edited the config that actually serves your domain.

Does Permissions-Policy affect SEO or performance?

No measurable performance cost — it's a few bytes per response. It doesn't affect rankings directly, but a misconfigured policy can break page resources, so test before enforcing.

Which compliance frameworks reference Permissions-Policy?

OWASP ASVS V14.4, SOC 2 CC6.8.

Related guides